CVE-2026-93116

Source
https://cve.org/CVERecord?id=CVE-2026-93116
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-93116.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-93116
Downstream
Related
Published
2026-09-17T16:11:23Z
Modified
2026-10-28T02:31:08Z
Severity
  • 7.0 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
platform/x86: asus-wmi: fix resource leaks on probe failure
Details

In the Linux kernel, the following vulnerability has been resolved:

platform/x86: asus-wmi: fix resource leaks on probe failure

During driver initialization in asus_wmi_add(), various subsystems are registered sequentially. However, the error path labels are out of order relative to the registration sequence.

Specifically:

  1. If asus_wmi_custom_fan_curve_init() fails, the driver jumps to fail_custom_fan_curve. Because this label is placed below fail_sysfs, it bypasses the cleanup calls for the input device and sysfs groups, which were successfully registered before, leaking those resources.
  2. If asus_screenpad_init() fails, the driver jumps to fail_screenpad. Because fail_screenpad is placed below fail_backlight, it bypasses the cleanup calls for backlight and rfkill, leaking those resources.

Fix these resource leaks by reordering the error path labels in asus_wmi_add() to match the exact reverse order of the resource allocations.

Database specific
{
    "cna_assigner":  "Linux",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93116.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
0f0ac158d28ff78e75c334e869b1cb8e69372a1f
Fixed
959ed35f8c8f07b8dd43c3f917a43ae2f77e4471
Fixed
8d5999608da60db45949e5459f74f581cdaacd04
Fixed
8410cd2690d463b60527d00ac8cffea2d5a041f6
Fixed
3308b8c5f5a28403611a2f5a46f06aabe4f0c661
Fixed
ef3daa2b84a2b8499ce9e2ce1c865dca36d39f95

Database specific

source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-93116.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.17.0
Fixed
6.6.160
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.114
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.18.57
Type
ECOSYSTEM
Events
Introduced
6.19.0
Fixed
7.2.6

Database specific

source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-93116.json"